Dana, Jason T. wrote:
> I am trying to configure pam and/or nslcd to query an AD/LDAP server when a
> user accesses a system via SSH using public key authentication.
>
> I have successfully configured nslcd to query the AD/LDAP server and filter
> on a specific group. Unfortunately it does not appear to apply if the user is
> accessing the system using public key authentication. I have attempted a
> number of different sshd pam configuration changes and have added a
> pam_authz_search entry to nslcd.conf, but unfortunately none appear to be
> getting used.
>
> Is this even possible or am I going down the wrong route?
>
> Any help would be greatly appreciated! Thank you!
It's not clear to me WHY you want sshd to issue an LDAP query.
Usually that is a means to an end, not an end in itself.
Is this so there is an audit trail in the log of LDAP queries?
Do you want the OpenSSH server to require multi-factor authentication --
that is, the user has to use BOTH their id_ed25519 AND their login password?
AuthenticationMethods publickey,password publickey,keyboard-interactive
https://man.openbsd.org/sshd_config#AuthenticationMethods
IIRC dropbear and tinysshd do not support PAM whatsoever, but
should still use nss when built against glibc.

This archive was generated using
mhonarc
on Mon Jun 01 04:04:34 2020.
If you have any questions about these pages, please contact
listmaster [at]
arthurdejong.org.
Please see the mailing list policy and disclaimer.